Jump to content
Converge

Windows Server Backup Monitoring

Recommended Posts

Hi All,

So we have just onboarded to Automate version 11 and are having trouble with setting up a monitor to check for backup sucess and failures, does anyone have any pointers or advice on how we can do this since it doesnt natively support this without the use of custom  monitors.

So far we have configured monitors for Max Backup and have the plugins for Veeam its just Windows Backup were stuck on.

Thanks
Matt B

Share this post


Link to post
Share on other sites

HI Matt,

I know we chatted on Slack but thought I'd post the solution up here so others can see it. You will need the Windows Server Backup Command Line Tools feature installed for this to work. I have tested it on Server 2008 plus and this is Powershell 2 compatible.

First step is to configure a role - See the attached SQL, Tools > Import > SQL in the main control center. Do an update config on all agents, then a resend system info - this should then start picking up the role.

Second step is to create a search that searches for agents with this role.

Third step is to create a greyed out master group called something like Windows Server Backup Monitoring and attach the search to the group and let the group populate.

Choose a machine to test the remote monitor we are going to setup. Right click > monitors > add new monitor. Choose yes to use the wizard. Choose Monitor the results of an executable. Leave LTSharePresets empty and paste this in the executable / arguments: I would recommend removing the $UKCulture Line

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "& {$ErrorActionPreference = 'SilentlyContinue';$ukCulture = [Globalization.cultureinfo]::GetCultureInfo('en-GB');add-pssnapin windows.serverbackup;$wbs = Get-Wbsummary;$lastsuccessfulbackuptime = $wbs.lastsuccessfulbackuptime;$TimeSpan = $(Get-Date) - [DateTime]$($wbs.lastsuccessfulbackuptime);write-output $($timespan.TotalDays)}"

On the comparison function, like all remote monitors we test for the GOOD condition. Choose Less than, then choose the amount of days that is a good threshold. Choose Next, Next and choose a frequency for this to run. I'd recommend hourly to daily. Set your alert style and template, carry on to name the monitor and then once the monitor is created ensure that it is pulling back an accurate value - manually check this.

Once you are happy, drag the remote monitor from the agent to the group and this will install the remote monitor on all in that group.

Give it a few minutes and then load monitors and search for your monitor name - this will give you an overview of all remote monitors and their respective output and should allow you to determine you are getting results back from all agents with the role detected. I'd advise spot checking to make sure the results are accurate.

To go an extra step, I have a script running against the group that populates EDFs:

image.png

I then use these EDF values in reports that I run for Overall backup health.

These are using an Execute Script > Powershell Bypass function where I then write the result back into an EDF:

<#
Script Author: Gavin Stone
Script Version: 1.0.0
Script Date: 21/07/2016
Script Description: Populates an extra data field for the last successful windows server backup
#>

$ErrorActionPreference = 'SilentlyContinue'
$ukCulture = [Globalization.cultureinfo]::GetCultureInfo("en-GB")

add-pssnapin windows.serverbackup
$wbs = Get-Wbsummary
$lastsuccessfulbackuptime = $wbs.lastsuccessfulbackuptime

write-output $($lastsuccessfulbackuptime)

As an example of one of those. I have others running for the other fields.

Hope that helps.

 

Windows Server Backup Role.sql

  • Like 1

Share this post


Link to post
Share on other sites

Another way to monitor Windows Server Backup:

Windows EventID 4 (Informational, Microsoft-Windows-Backup) is logged with a successful job. All possible fails are logged with other event id's. So monitoring them will be a pain in the ass because you have to apply a lot of monitors. But if you reverse the way of monitoring, you need to know when a backup server did not log eventid4 in a 24h time-span.

So first of all, create a template for crimson events to receive events from Microsoft-Windows-Backup.
Apply this template to the group of servers you need to monitor. Events will come in in the "other" logs.
Next, blacklist the event. Monitoring blacklisted events is more database efficient then monitoring eventlogs.
Create an internal monitor with the check condition: Eventlogs, blacklistID=XXX(the ID from the blacklisted event) and most important.... Check the Reverse Query checkbox.

Put the interval on daily (or more often if you use multiple backup schemes) and alert frequency @ once per day. Add your alert and you're ready to go.

Have a great day.

Share this post


Link to post
Share on other sites

We had so many issues trying to monitor successfully Windows Server Backup.

Thanks Gavsto for your solution - it is working perfectly :) I also learnt a few new things along the way so that was a big bonus for me!

Kevin

 

 

Share this post


Link to post
Share on other sites

Thanks @Gavsto for this! Everything seems to be working well except some of the servers are not coming up.

I did a little digging and the role detection looks for the "/" character in the return from "get-wbpolicy | select schedule". The problem is that some of the servers have dates that use the format YYYY-MM-DD rather than YYYY/MM/DD. 

Since get-wbpolicy will return nothing if there is no backup scheduled, I changed the result to "{" instead of "/" and it is detecting all the servers now. 

Share this post


Link to post
Share on other sites
On 12/29/2017 at 3:16 PM, Duvak said:

Another way to monitor Windows Server Backup:

Windows EventID 4 (Informational, Microsoft-Windows-Backup) is logged with a successful job. All possible fails are logged with other event id's. So monitoring them will be a pain in the ass because you have to apply a lot of monitors. But if you reverse the way of monitoring, you need to know when a backup server did not log eventid4 in a 24h time-span.

So first of all, create a template for crimson events to receive events from Microsoft-Windows-Backup.
Apply this template to the group of servers you need to monitor. Events will come in in the "other" logs.
Next, blacklist the event. Monitoring blacklisted events is more database efficient then monitoring eventlogs.
Create an internal monitor with the check condition: Eventlogs, blacklistID=XXX(the ID from the blacklisted event) and most important.... Check the Reverse Query checkbox.

Put the interval on daily (or more often if you use multiple backup schemes) and alert frequency @ once per day. Add your alert and you're ready to go.

Have a great day.

hi,

I have just created a Crimson log.

where can I find the logs?
Can somebody help me to create the internal monitor on this?

thx

Share this post


Link to post
Share on other sites
On 12/29/2017 at 3:16 PM, Duvak said:

Another way to monitor Windows Server Backup:

Windows EventID 4 (Informational, Microsoft-Windows-Backup) is logged with a successful job. All possible fails are logged with other event id's. So monitoring them will be a pain in the ass because you have to apply a lot of monitors. But if you reverse the way of monitoring, you need to know when a backup server did not log eventid4 in a 24h time-span.

So first of all, create a template for crimson events to receive events from Microsoft-Windows-Backup.
Apply this template to the group of servers you need to monitor. Events will come in in the "other" logs.
Next, blacklist the event. Monitoring blacklisted events is more database efficient then monitoring eventlogs.
Create an internal monitor with the check condition: Eventlogs, blacklistID=XXX(the ID from the blacklisted event) and most important.... Check the Reverse Query checkbox.

Put the interval on daily (or more often if you use multiple backup schemes) and alert frequency @ once per day. Add your alert and you're ready to go.

Have a great day.

hi,

I have just created a Crimson log.

where can I find the logs?
Can somebody help me to create the internal monitor on this?

 

Is this the correct backup log name? : Microsoft-Windows-Backup/Operational

thx

Share this post


Link to post
Share on other sites

Below is our internal monitor configuration for Window Server Backup.

We run the monitor daily, and check for event logs in the last 24 hours (as per additional condition, - interval 1 day).
Each morning at 6.30 we get a ticket created for each windows backup job/event log.
If we don't get an email with a success then someone will connect in and review.

image.thumb.png.8ef605a6c4387cc38e3a9b7fb1e19235.png

Share this post


Link to post
Share on other sites

I want to configure it so that when no event "4" is found in 2 days, only than an alert is launched.

In your case you will have to check the alert emails daily.

Share this post


Link to post
Share on other sites

We have something similar to report on this and it includes reporting on Azure backup as well as backup exec. Or anything that logs a success to the eventlog.

Basically we make sure that an event goes into the application event log and we have monitors which pick up these logs and register in an EDF the last success event as Gavin had at the start. We couple this up with an automate report that gets sent out every morning which creates an excel sheet reporting from the EDF that flags as Orange if no back up in the last 24 hours and red if no backup greater than that.

Our engineers then just need to review this spreadsheet and zoom straight in on the orange and red entries

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...